Dolibarr SQL Filter Bypass Leading to Password Hash Disclosure

Executive Summary

CVE-2026-89012 is a case-sensitive denylist bypass vulnerability in Dolibarr versions 24.0.0 through 24.0.1. It affects the sqlfilters API query parameter, allowing authenticated attackers to bypass denylist protections by using uppercase variants of protected field names. Attackers exploit case-insensitive database column resolution against a case-sensitive denylist check to extract sensitive data, including full password hashes for all user accounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Dolibarr API requests for the sqlfilters parameter containing uppercase variants of protected field names like PASSWORD or USER_PASSWORD. Check logs for case-insensitive SQL queries bypassing denylist checks. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated attackers to recover protected database fields, including full password hashes for any user account, such as administrators. Attackers can use prefix-matching predicates as a boolean oracle to extract sensitive information, potentially leading to unauthorized access and data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dolibarr to version 24.0.1 or later to apply the patch fixing the case-sensitivity issue in sqlfilters. Review API access logs for suspicious queries and restrict authenticated user privileges until patched.

Useful 0 Not Useful 0